Ever looked at your log watch and seen messages that there were X number of probes on your
webserver?
I'm assuming the vast majority of these "probes" come from script kiddies running things like
nikto. Are there any tools out there like denyhosts but for httpd's logs... to block IPs that
appear to be probing the webserver? If so, I'd really like to get that deployed.
I've heard that fail2ban can be used with httpd but I believe it is only for finding failed
.htaccess login attempts and I'd rather detect nikto scans and block those.
Anyone?